Verifying a Certificate's Validity on Your Computer

Date Submitted: 2/2/15

When an application receives digitally signed or secured content from the Internet, such as HTTPS-secured websites or signed software, it must verify that the certificate used to secure the content, such as an SSL or code signing certificate, is valid.

Applications, such as Web browsers and operating systems, validate certificates using Certification Revocation Lists or the Online Certificate Status Protocol.

Applications use two types of verification methods to check the validity of a digital certificate:

Certification Revocation Lists (CRLs) — A CRL is a list of revoked certificates. Applications that use CRLs to verify certificates automatically download the entire CRL file and check the status of the certificate with the list. If it is revoked and listed in a CRL, the application should not trust it.

Online Certificate Status Protocol (OCSP) — An OCSP service is query-based. Applications that use OCSP check the status of a certificate without the need to download a CRL. OCSP provides a "good" or "revoked" response.

This chart is a guideline for how common applications and operating systems verify certificates. However, some applications or operating systems might be configured to perform differently.

Software vendors determine the validation method. The Certification Authority has no control over how a certificate is validated.

CRLs and OCSP use HTTP to retrieve information from the following servers. If you are a network administrator for your organization, make sure all computers in your network that might encounter a digital certificate issued by us can access these CRL and OCSP services.